Merge pull request #42 from iress/openid-secure-samesite

Set cookies as `secure` and `samesite: strict`in open github and openid
iress · Sep 26, 2023 · c84be23 · c84be23
2 parents fee9836 + 360ada9
commit c84be23
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 11 deletions.
diff --git a/authn/github.index.js b/authn/github.index.js
@@ -70,16 +70,23 @@ function mainProcess(event, context, callback) {
                         }],
                         "set-cookie" : [{
                           "key": "Set-Cookie",
-                          "value" : cookie.serialize('TOKEN', jwt.sign(
-                            { },
-                            config.PRIVATE_KEY.trim(),
+                          "value" : cookie.serialize(
+                            'TOKEN',
+                            jwt.sign(
+                              { },
+                              config.PRIVATE_KEY.trim(),
+                              {
+                                audience: headers.host[0].value,
+                                subject: auth.getSubject(username),
+                                expiresIn: config.SESSION_DURATION,
+                                algorithm: 'RS256'
+                              } // Options
+                            ),
                             {
-                              audience: headers.host[0].value,
-                              subject: auth.getSubject(username),
-                              expiresIn: config.SESSION_DURATION,
-                              algorithm: 'RS256'
-                            } // Options
-                          ))
+                              sameSite: 'strict',
+                              secure: true
+                            }
+                          )
                         }],
                       },
                     };

diff --git a/authn/openid.index.js b/authn/openid.index.js
@@ -181,7 +181,9 @@ function mainProcess(event, context, callback) {
                           } // Options
                         ), {
                           path: '/',
-                          maxAge: config.SESSION_DURATION
+                          maxAge: config.SESSION_DURATION,
+                          sameSite: 'strict',
+                          secure: true
                         })
                       },
                       {
@@ -309,7 +311,9 @@ function redirect(request, headers, callback) {
           "key": "Set-Cookie",
           "value" : cookie.serialize('NONCE', n[1], {
             path: '/',
-            httpOnly: true
+            httpOnly: true,
+            sameSite: 'strict',
+            secure: true
           })
         }
       ],